TW200418297A - Multisignature scheme with message recovery for group authorization in mobile networks - Google Patents
Multisignature scheme with message recovery for group authorization in mobile networks Download PDFInfo
- Publication number
- TW200418297A TW200418297A TW92105426A TW92105426A TW200418297A TW 200418297 A TW200418297 A TW 200418297A TW 92105426 A TW92105426 A TW 92105426A TW 92105426 A TW92105426 A TW 92105426A TW 200418297 A TW200418297 A TW 200418297A
- Authority
- TW
- Taiwan
- Prior art keywords
- signature
- message
- mod
- signer
- individual
- Prior art date
Links
Landscapes
- Mobile Radio Communication Systems (AREA)
Abstract
Description
200418297 玖、發萌說明 (發明說明應敘明：發明所屬之技術領域、先前技術、內容、實施方式及圖式簡 單_) 【發明所屬之技術領域】 本發明係有關於一種'用於群體授權（group authorization) 之多重簽章機制（multisignature scheme)，更特別有關於一種 用於群體授權且具有訊息還原功能之有效多重簽窣檄制’該機 制係用於一不可靠之網路系統中例如：具有不可靠之通訊胃 結且屢次連不上主機等特性之行動網路。 10 200418297 [先前撕] ， 隨著科技與半導體技術之發~展，電腦已廣受流行，且透過 電腦網路做資訊交換，更是與日俱增。因此，資訊的保護措施 引起關注例如：資訊交換者之身份鑑定。目前社會已進入資訊 化階段，資訊將如同辨識貨物一般，且透過公開通訊網路之資 訊傳輸更形重要。相對地，由於資訊的非法暴露或變更所造成 之損害也會持續增加。 4i 爲了預防損害，透過通訊網路例如：公開通訊網路傳遞資 訊時之保護措施更引起關注，且相關的各種硏究正迅速展開。 例如：鑑定機制（identiHcationscheme)已被提出，用以當資 料透過各種通訊路徑例如：公開通訊網路做交換時，允許證實 一同爲通訊者身分或所接收之資料來源；以及數位簽章機制 (digital signature scheme)，用以於通訊程序前之終端機上， 使一電子文件之一數位簽章產生效力，其中該數位簽章係爲一 創作者編碼而成之二位元序列簽章，取代了傳統文件上之手寫 簽名方式。該電子簽章機制使所傳送之文件來源能被鑑定如： 內容確認與文件是否被非法變更。 於該鑑定機制與數位簽章機制中，假設p係爲一大質數， q係爲另一用於除p-1之質數，g係爲一介於1與p間之自然 數’且g之q次方除以p會得一餘數1 (sgqmodp)，然後g，q 與P係通常爲使用者利用之系統係數。假如每一使用者隨機選 取一介於1與q之數s當成一秘密金鑰（secret key )，且使用 一由g之-s次方除以p而得的餘數v ( g·5 mod p)爲一公開金 1 200418297 鑰（public key)，而個別使用者所使用之公開係數係爲<，g，q 與P 0 從這些公開係數中找出一秘密金鑰s係爲困難。真難度也 等於計算一散離對數之解。許多公開金鑰鑑定機制與數位簽章 機制係以困難的散離對數計算爲安全基礎。 一數位簽章可視爲一印章之特殊形式，而且該數位簽童使 用於一需受信任之訊息來源（如同印章做驗證）。有三種數位-簽章機制之模式：一具有附件之數位簽章機制、一授予訊息還 原功能之數位簽章、以及一整合這些方法之混合型（hybrid) 數位簽章機制。 具有附件之數位簽章機制模式中，該數位簽章與其對應的 訊息一倂送給一收件者。該訊息本身並無加密且受該收件者驗 證。使用附件模式之著名數位簽章機制係爲ElGamal數位簽章 機制，其中該機制係以散離對數問題爲基礎。 於使用附件型式與訊息還原型式所組合而成之混合型數 位簽章機制中，適當地將一訊息之一數位簽章產生成爲附件型 態或訊息還原型態，係依據簽署訊息之長度（二位元字串）或 簽章目的做決定。對一短訊息而言，該混合型簽章機制使用訊 息還原方法，使得驗證數位簽章之資料量減少，同時通訊量之 需求也會減少。對一長訊息而言，當包括了訊息相關之資訊 時，則該混合型簽章機制使用附件方法。如上所述，該混合型 數位簽章機制之特點，係能適應性的依據一簽署訊息之長短產 生一數位簽章。 200418297 於授予訊息還原功能之數位簽章機制，該簽署訊息隱藏於 簽章內，而且可從該簽章還原。訊息還原有一些明顯之優點。 首先，小訊息之簽章會有更小的頻寬需求。其次，可產生更短 小的憑證（certificate)。此外，訊息還原功能可直接使用於其 它機制例如：ElGamai加密機制（encryption scheme )或換鏡協 定（key agreement protocol)，具有訊息還原功能之著名數位簽 章機制係爲RSA數位簽章機制，其中該機制之基礎係建立於-分解大整數之困難上。 於丨994年，Nyberg與Rueppd提出第一個以散離對數爲 基礎且具有訊息還原功能之機制。該具有訊息還原功能之數位 簽章機制產生一用於一訊息之數位簽章。另外，假如通訊雙方 使用相同系統係數，則藉由使用與數位簽章相同之演算法，能 夠產生一協議金繪（session key)當成雙方之秘密金鏡。N-R (Nyberg-Rueppd)的授予訊息還原功能之數位簽章機制將於 下做說明。 假設簽署者之系統係數係爲g、q與P，秘密金鑰係爲s (l<s<q)，公開金鑰係爲v ( mod p)，以及簽署之訊息係 爲m。該簽署者係選取一介於1與q之間之任意數r，而且計 算一由m與g之-r次方的乘積除以p而得的餘數x( mod p)。該簽署者之r與乘上x之該秘密金鑰s相加，其結果係爲. r + sx，再計算由r+sx除以p而得之一餘數y( ^r+sx mod q )。（ x,y ) 係爲用於還原訊息m的具有訊息還原功能之數位簽章。爲了 驗證該數位簽章（X，y)，驗證者計算一由X、g之y次方、以 200418297 及V之x次方的乘積除以P而得的餘數（^KgYvx mod p)，用以 還原該訊息m。驗證者可藉由證實該還原後之訊息m之內容 去驗證該數位簽章（x，y)之確實性。 於此，將對金鑰交換方法做一詳細說明，其中使用與N-R 數位簽章機制相同之演算法，使得於使用者之間產生一協議金 鏡。 假設使用者A與B共同使用系統係數g，q與p，該使用者ία 之 秘密金 鑰係爲 sa ， 且其 公開金 鑰係爲 vA ( sg_sA mod p ) ， 而 該使用者B之秘密金鑰係爲sb，且其公開金鑰係爲vB(^g’sBmod P)。當使用者A與B之間欲產生一協議金鑰時，使用者A選 取一介於1與q之間之任意數R或r，且計算X (3Rg〃modp) 與y ( r+sA mod q)。該計算結果（x，y)送至B。使用者A計算 協議金鑰K ( <vb)r)，該數係由使用者B之公開金鑰νΒ ( mod ρ)之R次方除以ρ而得的餘數。使用者Β從使用者Α所 接收之（x，y)計算gR( ^gY vax mod p)，藉此還原gR，而且計 算由gR2-sB次方除以ρ而得的餘數K(<gRVSBmodp)。因此， 藉由一次傳送/接收，使用者A與B相互之間能夠產生協議金 _。 對於另一將基礎建立於散離對數問題之安全的金鑰交換 而言，已提出Diffe-Hellman金鑰交換方法，用以於兩位使用 者之間產生一協議金錄。於該方法中，假設兩位使用者A與B 係使用g，q與P爲系統係數，該使用者A與B係個別選取介 於i與q之間之兩任意數a與b，且計算£&與gb。假如將所算 200418297 /出之〆與gig互交換，則使用者A與B —般會得到K値。 習用之數位簽章機制通常只允許單一簽署者簽署一訊 '害、。然而，對於某些網路環境而言，簽署一訊息之責任或許是 歸屬於一群簽署者，而且一訊息可能需要藉由多位簽署者做簽 署授權。 於群體導向應用上，一訊息之群體授權可藉由簽署該群成 員之數位簽章於該訊息上而達成。於該方法中，一群使用者可… 藉由簽署一含程式/文件之訊息而完成該訊息之授權，而且外 部驗證者可驗證該簽章，並決定該要求訊息之權限。例如：一 公司之政策於實施之前，必須經過一些經理投票或簽署做表 決；而目前認證代表（authenticating delegate)於一行動碼系 統中係爲另一種應用。所以有必要提供一種多重簽章方式。 一多重簽章係由一群具有多重保密觀念之簽署者所產 生。一般而言，一手寫（handwritten )多重簽章與一數位（digit ) 多重簽章之一最大不同點係在於多重簽章之形式大小。對於一 手寫式多重簽章，該形式大小與簽署者人數成線性關係，但對 於一數位式多重簽章，該形式大小則與單一簽署者完全相同。 於一多重簽章機制中，該群體所有成員合作產生一有效多 重簽章，而且每一成員對於該簽署訊息皆具有相同之責任。換 言之，一多重簽章之簽署者於開始時就被驗證，而且該多重簽 章之確實性必須與該使用者之公開金鑰一起被鑑定。因此，任 一局外者能確信，當該多重簽章產生時，該群體之每一成員係 爲一參與者。 200418297 然而，以這些機而言，該簽署者或簽名順序仍必須預先 決定，或者一多重簽章之大小變化仍與簽署者人數成比例。 考慮一群體#向服務爲例，該服務係於多個行動伺服器之 間所劃分，其中該伺服器可能是指定用戶所攜帶之行動裝置。 一客戶可發出含一文件/行動碼之一請求訊息給任一行動伺服 器。依據所接收之請求，該代表伺服器（delegate server)將 代表該群行動伺服器作出反應。該代表伺服器轉送該要求訊恳-給所有可連上線之伺服器並等待其回應。假如該代表伺服器從 該行動伺服器端接收到多於法定數量之回應時，該任務係成功 地完成，而且該代表伺服器會回傳結果給該客戶。於此運作程 序中，該參與運算之行動伺服器必須受認證，如此，非法入侵 才得以被偵測。也就是當回覆訊息回傳給該客戶時，就必須透 過一行動伺服器之法定數量作簽署。這對於一種具有訊息還原 能力之門檻多重簽章機制之需求產生了動機。於一可靠之網路 中，多重簽章機制可能已滿足需求。然而，對於不可靠之通訊 連結，以及屢次連不上主機之行動網路而言，或許還不夠。 此外，於多重簽章機制中，一外部之驗證者需要使用該群 體成員之所有公開金鑰以驗證該多重簽章之確實性。藉此，該 驗證者能夠確信每一位成員係爲該多重簽章之一參與者。該驗 證者所關切係爲一訊息至少必須透過〖位成員之簽署，而且 該成員係必須真正來自於該群體。然而，該驗證者沒辦法驗證 一群體成員是否參與該群體多重簽章之產生。因此，習用之多 重簽章機制於這些應用中並不可實行，而應該由（Λ /?)門檻 多重簽章機制取而代之。 於（Λ/0門檻多重簽章機制，該同一群體+之r個甚至更 多個成員合作產生一有效群體簽章。當一驗~證者需要驗證該簽 章之確實性時，該驗證者需要使用所有成員之公開金鑰去取得 該群體之公開金鑰。因爲該群體公開金鑰係由所有成員之公開 金鑰所取得，而並非由實際參與者，所以該驗證者不能對個剋 之參與簽署者做鑑定。 數位多重簽章機制與（Λ 門檻多重簽章機制於過去文 獻資料中已被提出，於1994年由L.Harri提出一以散離對數問 題爲基礎之平行數位多重簽章機制，見於"Group-oriented (t，η) threshold digital signature scheme and digital multisignature,,r IEE Proc. of Computers and Digital Technique., Vol. 141, No. 5, pp. 307-3 13, Sep. 1994.。該平行數位多重簽章機制允許多位簽 署者分別簽署一相同訊息，而且傳送該個別簽署訊息給一指定 之登記員（clerk)，該登記員使每一個別簽署生效，然後將所 有個別簽署組合成一多重簽章。此外，Harri將該多重簽章機 制發展成一平行（Λ /2)門檻多重簽章機制，見於"New digital signature scheme based on discrete logarithm," Electronics Letters^ Vol. 30, No· 5, pp. 396-298, Mai*. 1994.。於 U，/7)門檻多重簽 章機制中，該群體之T個甚至更多個成員合作產生一有效群 體簽章，而且該驗證者不需鑑定該個別簽署者，就可驗證該群 體簽章之確實性。然而，Harn所提出之機制，簽署者間之訊 息交換成本較高。此外，該機制不支援訊息還原功能，且訊息 200418297 並未加密。 另外，Langford首次介紹數位簽章標準（Digital Signature Standard ; DSS )，該標準係以（t，η )門檻多重簽章爲基礎， 見方令 “Threshold DSS Signatures without a Trusted Party，” Advances in Cryptology _ Crypto, 95 proceedings, Springer-Verlag pp. 397-409，1995。 一*種保密分享技術（secret sharing technique )之增修版本 係於私用金鑰實際構成前，用於產生該私用金鑰之分享部分。 有兩種普遍之門檻DSS多重數位簽章機制被提出。第一個 t-out-of-n門濫機制依靠一分享之預算名冊（pre-computed Ust)以防止分享者簽署超過一個具有相同k値之訊息。第二 個機制需要广^7位簽署者參與該簽章機制，用以達成 t-out-of-n之安全機制，因此對於大r値而言，係爲一種不切 實際之情形。Langford所提出之機制有可查明的安全等級，但 尙未提及訊息還原問題。 SMeh等人提出另一用於群體導向且以散離對數問題爲基 礎之平行數位多重簽章機制，見於"Digital Multisignature Schemes for Authenticating Delegates in Mobile Code Systems，” IEEE Transactions on Vehicular Technology, Vol. 49, No. 4, July 2000, pp. 1464-1473.。該機制提供訊息還原能力，而且對於訊 息交換成本之需求比Harn所提出之機制更低。該機制並無簽 署訊息於該機制之每對簽署者之間交換，有別於Harn之機 制。然而，該機制需要額外一共同信任之公證者以參與簽章產 生階段。且該機制不容許主機與通訊之連結失敗，而且未設計 於行動通訊應用中。 參考圖1，該圖顯示一說明數位簽章機制之表格，該數位 簽章係見頒佈給Park等人之美國專利第5,966,445號之先前技 術，其標題爲 “Identification scheme single or muiti-digital signature scheme giving message recovery single or multi-digitdi signature scheme with appendix key exchange scheme and blind digital signature scheme” 。其揭示了一鑑定機制，該機制允許 一證明者（prover)更確定地鑑定自己之身分給驗證者，而且 預防使用過之鑑定資訊被重複使用；一金鑰交換，其中於兩使 用間使用了一共同秘密金鑰，係爲了不允許一未經授權者之不 當利用；一授予訊息還原功能之數位簽章機制與具有附件之數 位簽章機制，且依據一簽署之訊息大小，用以產生一訊息還原 形式或具有附件形式之數位簽章；一多重數位（multi-digital) 簽章機制，用以允許多位簽署者產生有關於同一訊息之數位簽 章，而且依據一簽署之訊息長度，將該數位簽章產生爲一訊息 還原形式或具有附件之形式；以及一隱藏式（blind)數位簽 章機制，用以當簽署訊息不應開放於公開場合與簽署者時產 生，因此一簽署者不知道該訊息上之內容。 然而，儘管有了這些機制’該簽署者與簽名順序仍必須預 先決定，或者一多重簽章之大小變化仍與簽署者人數成比例。 且這些機制通常尙缺乏了訊息還原能力，或不可支援行動網路 中之群體授權。 200418297 有鑑於此，便有需要提供一種具有訊息還原功能之新式 (Λ 77)門檻多重簽章機制，該機制整合了（ Λ /7)門檻秘密分 /享機制（threshold secret sharing scheme)與多重簽章機制之理 念，習用之（乂 /?)門檻秘密分享機制將該主要秘密分解成^ 個投影，於此一方法中，除非每一個r投影被集合，否則主要 秘密将無法還原。而整合門檻秘密分直機制與多童機#〃 不容易。 « [內容] 本發明之主要目的在於提供一種具有訊息還原特性之有 效數位多重簽章機制，用以克服先前技術之缺點。 本發明之次要目的在於提供一種由多重簽章機制發展出 之（Λ刀）門檻多重簽章機制，其中該門檻多重簽章機制也具 有訊息還原能力，且支援行動網路中之群體授權。 依據本發明之主要目的，其提供一種一具訊息還原功能之 多重簽章機制之電腦實施方法，用以產生以及驗證數位簽章。 其中系統係數係爲大質數/7，α及一單向雜湊函數（〇ne-way hash function) Η:多位簽署者產生用於一訊息m之一連續數位 簽章；以及於0與；;"之間亂數選取其私用金鑰Xt，使得gcdiX^， = 1，然後計算Y1 = (c〇Xi mod/;當爲其公開金鑰，該方法 係包括下列步驟：多位簽署者之一初始簽署者簽署具有適當冗 位（redundancy)之訊息M，且Μ藉由該簽署者之私密金鑰 10 200418297 Χι加密後係成爲密文（ciphertext) m ;於1與/7-1之間選取一 隨機數h，而且計算一由與訊息m之乘積除以P而得的 餘數 rl ( = [m · (a)-klf mod p)，以及計算一由[XI -(上/ - rl)] 除以P-1而得的餘數sl( Ξ [XI - (i/ - rl)] 傳送（〜200418297 说明, sprouting description (the description of the invention should state: the technical field to which the invention belongs, the prior art, the content, the embodiments and the drawings are simple_) [Technical field to which the invention belongs] The present invention relates to a type of 'for group authorization (Multisignature scheme) for group authorization, more specifically about an effective multisignature system for group authorization with message restoration function. This mechanism is used in an unreliable network system such as : Mobile network with the characteristics of unreliable communication and repeated failure to connect to the host. 10 200418297 [Previously torn] With the development of technology and semiconductor technology, computers have become widely popular, and information exchange through computer networks is increasing day by day. Therefore, information protection measures have attracted attention, such as the identification of information exchangers. At present, society has entered the informatization stage. Information will be like identifying goods, and the transmission of information through public communication networks is even more important. In contrast, the damage caused by illegal disclosure or alteration of information will continue to increase. 4i In order to prevent damage, the protection measures when transmitting information through communication networks such as public communication networks are of even greater concern, and related investigations are rapidly underway. For example: the identification mechanism (identiHcationscheme) has been proposed to allow the verification of the identity of the correspondent or the source of the received data when the data is exchanged through various communication paths, such as public communication networks; and the digital signature mechanism (digital signature mechanism) scheme), which is used to make a digital signature of an electronic file effective on the terminal before the communication program, wherein the digital signature is a two-digit serial signature encoded by an creator, replacing the traditional Handwritten signature on the document. The electronic signature mechanism enables the source of the transmitted documents to be identified such as: content confirmation and whether the documents have been altered illegally. In this identification mechanism and digital signature mechanism, it is assumed that p is a large prime number, q is another prime number used to divide p-1, g is a natural number between 1 and p ', and q of g Divide the power by p to get a remainder 1 (sgqmodp), then g, q and P are system coefficients usually used by users. Suppose each user randomly selects a number s between 1 and q as a secret key, and uses a remainder v (g · 5 mod p) obtained by dividing the -s power of g by p. Is a public key, and the public coefficients used by individual users are <, g, q, and P 0. It is difficult to find a secret key s from these public coefficients. True difficulty is also equivalent to computing a solution of a scattered logarithm. Many public key authentication mechanisms and digital signature mechanisms are based on difficult discrete logarithmic calculations. A digital signature can be considered a special form of a seal, and the digital signature is used by a trusted source (as if the seal is used for verification). There are three models of digital-signature mechanisms: a digital signature mechanism with attachments, a digital signature granting message reversion function, and a hybrid digital signature mechanism that integrates these methods. In the digital signature mechanism mode with attachments, the digital signature and its corresponding message are sent to one recipient at a time. The message itself is not encrypted and verified by the recipient. The well-known digital signature mechanism using the attachment mode is the ElGamal digital signature mechanism, which is based on the discrete logarithm problem. In a hybrid digital signature mechanism using an attachment type and a message restoration type, a digital signature of one message is appropriately generated into an attachment type or a message restoration type, which is based on the length of the signed message (2 Bit string) or signature purpose. For a short message, the hybrid signature mechanism uses a message restoration method, which reduces the amount of data for verifying digital signatures and reduces the need for communication. For a long message, when message-related information is included, the hybrid signature mechanism uses the attachment method. As mentioned above, the characteristic of this hybrid digital signature mechanism is that it can adaptively generate a digital signature based on the length of a signed message. 200418297 In the digital signature mechanism that grants the message restoration function, the signature message is hidden in the signature and can be restored from the signature. Message restoration has some significant advantages. First of all, small message signatures will require less bandwidth. Secondly, shorter certificates can be generated. In addition, the message restoration function can be directly used in other mechanisms such as: ElGamai encryption scheme or key agreement protocol. The well-known digital signature mechanism with message restoration function is the RSA digital signature mechanism. The foundation of the mechanism is based on the difficulty of-factoring large integers. In 994, Nyberg and Rueppp proposed the first mechanism based on scattered logarithms and capable of restoring information. The digital signature mechanism with message restoration function generates a digital signature for a message. In addition, if the two communication parties use the same system coefficient, by using the same algorithm as the digital signature, a session key can be generated as the secret mirror of the two parties. The digital signature mechanism of N-R (Nyberg-Rueppd) 's grant message restoration function will be explained below. Assume that the signer's system coefficients are g, q, and P, the secret key system is s (l < s < q), the public key system is v (mod p), and the signed message system is m. The signer selects an arbitrary number r between 1 and q, and calculates a remainder x (mod p) obtained by dividing the product of m and g to the power of -r by p. The signer's r is added to the secret key s multiplied by x. The result is .r + sx, and then a remainder y is calculated by dividing r + sx by p (^ r + sx mod q) . (X, y) is a digital signature with a message restoring function for restoring message m. In order to verify the digital signature (X, y), the verifier calculates a remainder (^ KgYvx mod p) obtained by dividing the product of X, g to the power of y, 200418297, and V to the power of x, divided by P, using To restore the message m. The verifier can verify the authenticity of the digital signature (x, y) by confirming the content of the restored message m. Here, the key exchange method will be described in detail, in which the same algorithm as the N-R digital signature mechanism is used, so that an agreement golden mirror is generated between users. Assume that users A and B use the system coefficients g, q, and p. The secret key of the user ία is sa, and the public key is vA (sg_sA mod p), and the secret gold of the user B is The key system is sb, and its public key system is vB (^ g'sBmod P). When user A and B want to generate a protocol key, user A selects an arbitrary number R or r between 1 and q, and calculates X (3Rg〃modp) and y (r + sA mod q ). The calculation result (x, y) is sent to B. User A calculates the protocol key K (< vb) r), which is the remainder obtained by dividing the power of R of user B's public key vB (mod ρ) by ρ. User B calculates gR (^ gY vax mod p) from (x, y) received by user A, thereby restoring gR, and calculates the remainder K (< gRVSBmodp) obtained by dividing the power of gR2-sB by ρ ). Therefore, with one transmission / reception, users A and B can generate agreement money _ with each other. For another secure key exchange that is based on the discrete logarithm problem, the Diffe-Hellman key exchange method has been proposed to generate an agreement gold record between two users. In this method, suppose two users A and B use g and q and P are system coefficients. The users A and B individually select two arbitrary numbers a and b between i and q, and calculate £ & and gb. If the calculated 200418297 / 出 〆 is exchanged with gig, users A and B will generally get K 値. The conventional digital signature mechanism usually only allows a single signatory to sign a message. However, for some network environments, the responsibility for signing a message may belong to a group of signers, and a message may require signing authority for multiple signers. In group-oriented applications, the group authorization of a message can be achieved by signing the digital signature of the group member on the message. In this method, a group of users can ... complete the authorization of the message by signing a message containing a program / document, and an external verifier can verify the signature and determine the authority of the requested message. For example: before a company's policy is implemented, it must be voted or signed by some managers; and the current authentication delegate is another application in an action code system. Therefore, it is necessary to provide a multiple signature method. A multiple signature is created by a group of signatories with multiple concepts of confidentiality. Generally speaking, one of the biggest differences between a handwritten multiple signature and a digit multiple signature is the size of the multiple signature. For a handwritten multiple signature, the size of the form is linear with the number of signers, but for a digital multiple signature, the size is exactly the same as a single signer. In a multiple signature mechanism, all members of the group cooperate to produce an effective multiple signature, and each member has the same responsibility for the signed message. In other words, the signer of a multi-signature is verified at the outset, and the authenticity of the multi-signature must be verified along with the user's public key. Therefore, any outsider can be confident that when the multiple signatures are created, each member of the group is a participant. 200418297 However, for these machines, the signer or signature sequence must still be determined in advance, or the size of a multiple signature will still be proportional to the number of signers. Consider a group #direction service as an example, the service is divided among multiple mobile servers, where the server may be a mobile device carried by a designated user. A client can send a request message containing a document / mobile code to any mobile server. Based on the request received, the delegate server will respond on behalf of the group of mobile servers. The representative server forwards the request to all available servers and waits for their response. If the representative server receives more than the legal number of responses from the mobile server, the task is successfully completed, and the representative server returns the result to the client. In this operation procedure, the mobile server participating in the calculation must be authenticated, so that illegal intrusion can be detected. That is, when the reply message is returned to the client, it must be signed through a quorum of a mobile server. This has motivated the need for a threshold multi-signature mechanism with the ability to restore information. In a reliable network, multiple signature mechanisms may be sufficient. However, it may not be enough for unreliable communication links and mobile networks that repeatedly fail to reach the host. In addition, in the multi-signature mechanism, an external verifier needs to use all public keys of members of the group to verify the authenticity of the multi-signature. In this way, the validator can be confident that each member is a participant in the multi-signature. The verifier's concern is that a message must be signed by at least one of the members, and that the member must be truly from that group. However, the verifier was unable to verify whether a group member was involved in the generation of multiple signatures for the group. Therefore, the multi-signature mechanism used in these applications is not feasible in these applications, and should be replaced by the (Λ /?) Threshold multi-signature mechanism. In the (Λ / 0 threshold multi-signature mechanism, r or even more members of the same group + cooperate to generate a valid group signature. When a verification ~ certifier needs to verify the authenticity of the signature, the verifier The public keys of all members need to be used to obtain the public keys of the group. Because the group public keys are obtained by the public keys of all members, not the actual participants, the validator cannot verify Participants are identified. Digital multi-signature mechanism and (Λ threshold multi-signature mechanism have been proposed in the past literature. In 1994, L. Harri proposed a parallel digital multi-signature based on the discrete logarithm problem. Mechanism, see " Group-oriented (t, η) threshold digital signature scheme and digital multisignature ,, r IEE Proc. Of Computers and Digital Technique., Vol. 141, No. 5, pp. 307-3 13, Sep. 1994: The parallel digital multiple signature mechanism allows multiple signers to sign the same message separately, and sends the individual signing message to a designated clerk, which makes each individual sign The signature comes into effect, and then all individual signatures are combined into a multiple signature. In addition, Harri developed the multiple signature mechanism into a parallel (Λ / 2) threshold multiple signature mechanism, as seen in "New digital signature scheme based on discrete logarithm," Electronics Letters ^ Vol. 30, No. 5, pp. 396-298, Mai *. 1994. In U, / 7) Threshold multiple signature mechanism, T or more members of this group cooperate to generate one A valid group signature, and the verifier can verify the authenticity of the group signature without identifying the individual signer. However, the mechanism proposed by Harn has a higher cost of information exchange between signers. In addition, the mechanism The message restoration function is not supported, and the message 200418297 is not encrypted. In addition, Langford introduced the Digital Signature Standard (DSS) for the first time, which is based on the (t, η) threshold multiple signatures. See “Threshold” DSS Signatures without a Trusted Party, "Advances in Cryptology _ Crypto, 95 proceedings, Springer-Verlag pp. 397-409, 1995. An enhanced version of the secret sharing technique is used to generate the shared part of the private key before the private key is actually formed. Two general threshold DSS multiple digital signature mechanisms have been proposed. The first t-out-of-n gate spam mechanism relies on a shared pre-computed Ust to prevent sharers from signing more than one message with the same k 値. The second mechanism requires the participation of 7 signatories to achieve the t-out-of-n security mechanism. Therefore, it is an unrealistic situation for large companies. The mechanism proposed by Langford has a identifiable level of security, but 尙 does not mention the problem of message restoration. SMeh et al. Proposed another parallel digital multi-signature mechanism for group-oriented and based on the discrete logarithm problem, see "Digital Multisignature Schemes for Authenticating Delegates in Mobile Code Systems," IEEE Transactions on Vehicular Technology, Vol. 49 , No. 4, July 2000, pp. 1464-1473. This mechanism provides the ability to restore information and requires less information exchange costs than the mechanism proposed by Harn. The mechanism does not sign messages to each pair of the mechanism The exchange between signers is different from Harn's mechanism. However, this mechanism requires an additional notary who has mutual trust to participate in the signature generation stage. The mechanism does not allow the connection between the host and the communication to fail, and is not designed for mobile communication With reference to Figure 1, this figure shows a table illustrating a digital signature mechanism, which is the prior art of US Patent No. 5,966,445 issued to Park et al., Entitled "Identification scheme single or muiti- digital signature scheme giving message recovery single or multi-digitdi signature scheme with appe ndix key exchange scheme and blind digital signature scheme ". It reveals an authentication mechanism that allows a prover to more surely identify himself to a verifier, and prevents reuse of used authentication information; Key exchange, in which a common secret key is used between the two uses, in order to not allow improper use by an unauthorized person; a digital signature mechanism granting a message restoration function and a digital signature mechanism with an attachment, and According to the size of a signed message, it is used to generate a digital signature in the form of a restored message or an attachment; a multi-digital signature mechanism is used to allow multiple signers to generate digital information about the same message Signature, and based on the length of a signed message, the digital signature is generated as a message restoration form or with an attachment; and a blind digital signature mechanism is used when the signed message should not be open to the public Occasionally occurs with signatories, so a signatory does not know what is on the message. However, despite these System 'of the signer and the signature sequence must still decide beforehand, or a multiple of the size of the signature change in the number of signatories and still proportional. And these mechanisms often lack the ability to restore information or support group authorization in mobile networks. 200418297 In view of this, it is necessary to provide a new (Λ 77) threshold multi-signature mechanism with a message restoration function, which integrates (Λ / 7) threshold secret sharing scheme and multi-signature The principle of the chapter mechanism, the (习 /?) Threshold secret sharing mechanism is used to decompose the main secret into ^ projections. In this method, unless each r projection is aggregated, the main secret cannot be restored. It is not easy to integrate the threshold secret direct connection mechanism and multi-child machine # 〃. «[Content] The main purpose of the present invention is to provide an effective digital multi-signature mechanism with the characteristics of message restoration to overcome the disadvantages of the prior art. A secondary objective of the present invention is to provide a (Λ-knife) threshold multiple signature mechanism developed from a multiple signature mechanism. The threshold multiple signature mechanism also has information restoration capabilities and supports group authorization in a mobile network. According to the main purpose of the present invention, it provides a computer-implemented method of a multiple signature mechanism with a message restoration function for generating and verifying a digital signature. The system coefficient is a large prime number / 7, α and a one-way hash function (one-way hash function) Η: multiple signers generate a continuous digital signature for a message m; and at 0 and ;; " Randomly select its private key Xt such that gcdiX ^, = 1 and then calculate Y1 = (c〇Xi mod /; as its public key, the method includes the following steps: multiple signers One of the initial signers signs the message M with appropriate redundancy, and M is encrypted with the signer's private key 10 200418297 χ to become a ciphertext m; between 1 and / 7-1 Select a random number h, and calculate a remainder rl (= [m · (a) -klf mod p) obtained by dividing the product of the message m with P, and calculate a result from [XI-(上 /-rl )] The remainder sl (Ξ [XI-(i /-rl)] divided by P-1 is transmitted (~
Sl，Η(Μ))給所有其他簽署者。一第i位簽署者（其中2 S i S /?)係使用Y1 · rl · (a)rl-sl還原該密文m，其中該f 6之 密文m在此標示爲m’ ；且藉由使用該初始簽署者之公開金 鑰去驗證該簽章（n，Sl)之確實性。接收（n，s^，H(M))之第 i位簽署者（其中2 Si ^/7)選取一介於1與Ρ-l之隨機數 么，而且計算由（a)-i:/與訊息m之乘積除以p而得的餘數ri ( ξ [m · (c〇士] παί/ /0，以及計算一由[Xi - (h - ri)]除以 p-1 而得 的餘數 si ( ξ [Xi - (h· - ri)] ;傳回（n，Sl)給該初 始簽署者。依據所接收之任一個別簽章（n，，其中2 S i 2 η，該初始簽署者使用Yi · ri · (a)ri-si還原該密文m，且藉 使用第i位簽署者之公開金鑰以驗證該個別簽章（n，sO之確 實性。該初始簽署者計算R( s[m· (a)- (ir/-rl)-…-(h-r/?) ] mod /7)與 S ( ξ R-i . [si + s2 +··.+ s；7] mod (/Μ))，組合一用於該 訊息M且含有n位簽署者之多重簽章（R，S，H(M));以及傳 送該多重簽章給外部驗證者。該外部驗證係依據所接收之該用 於訊息Μ之組合式多重數位簽章（R，S，H(M))，驗證該多重 簽章之確實性，而且藉由使用所有簽署者之公開金鑰Y,(其 中丨$ 1 S力），將訊息m從多重簽章中還原出來。 依據本發明之另一目的’其提供一種一具訊息還原功能之 200418297 (t，η)門檻多重簽章機制之電腦實施方法/用以產生以及驗 證數位簽章，其中系統係數係爲大質數A α及一單向雜湊函 數（one-way hash function) Η，多位簽署奢產生用於一訊息m 之一連續數位簽章，以及於〇與之間亂數選取其私用金鑰 ，使得gCiKXi，少/) = 1，然後計算丨Ξ (a)Xi mod 當爲其 公開金鏡，該方法係包括下列步驟：一第·:位簽署者於厂… 中選取一含Μ項之隨機多項式，使得—以π — …―山.〜/" mod ( Ρ-/)，其中U系爲第i位簽署者之私 用金鑰；而且於一安全通道中將傳送至仏（其中1 2 j S η，且j # i)以及播送^(~>111(3(1/7，多位簽署者中之一初始 簽署者簽署了具有適當冗位（redundancy )之訊息Μ，且Μ藉 由該簽署者之私密金鑰Xi加密後係成爲密文m ;於1與；7-1 之間選取一隨機數h，而且計算一由（c〇4/與訊息m之乘積除 以P而得的餘數rl ( ξ[πι · (a)-i7] 727^/0，以及計算一·由[Χία/ - rl) + OlLl] 除以 p-1 而得 的餘數 sl( 4X1 - U7 rl) + QiLl] /77W 傳送（n，si，H(M))給所有其他簽署者；其中因 爲只有仏知道每一個，所以 —1 只可藉 L, Ξ( ΓΤ —— mod(p-l)) 由UI做計算（其中任何〗古1)，且因爲 l 値 無關任何秘密資訊，所以該値係爲公開。該第i位簽署者（其 中2 s 1幺/0係使用Y1 · · rl · (c〇rl-sl還原該密文m ; 12 200418297 而且藉由使用該初始簽署者之公開金鑰以驗證該簽章（ri， 之確實性；其中該還原之密文m標示爲，而且 λχ ξ Y]L〇^/j(Xl) mod(/7-l) j^t+l 。該第i位簽署者（其中2 Si Sr)接 收（n, st，H(M))，選取一介於1與/;-1之隨機數么，而且計算 由（a)f與訊息m之乘積除以P而得的的餘數ri( 5 /?)，以及計算一由[Xi - (β - ri) - QiLi]除以P-i而ί守的餘κ 數 si ( 4Xi - (β - η) - QiLi] 仏-/刀；以及傳回（n，給 Ω/ Ξ 該初始簽署者，其中 ㈣ ，且 L, ξ ΓΤ —mod(p -1) k-l9k^i 一 “k 〇 依據所接收之任一個別簽章（η，s,)，其 中2 S i < t，該初始簽署者係使用Yi · λΐ · ri · (a)ri-si還 原該密文m，而且藉使用第1位簽署者之公開金鑰以驗證該個 λί = Y\afjiXi) mod{p-l) 別簽章（n，Si)之確實性；其中 >ί+1 。該初始 簽署者計算 R ( = [m · (a)- U/-rl) - ··· -(私⑺]mod ；7)與 S (R-1 · [si + s2 +.··+ sr] mod QM))，組合一用於該訊息 Μ 且 含有η位簽署者之多重簽章（R，S，Η(Μ));以及發送該多重簽 章給外部驗證者。依據所接收之該用於訊息Μ之組合式多重 數位簽章（R，S，H(M))，一外部驗證者驗證該多重簽章之確實 性，而且藉由使用所有簽署者之公開金鑰(其中1 S i S 77) 將訊息m從多重簽章中還原出來。 13 200418297 爲了讓本創作之上述和其他目的、特徵、和優點能更顯， 下文特舉本創作較佳實施例，並配合所附圖示，作詳細說明如 下。 [實施放] 下文特舉本發明之較佳具體實施例，並參照附圖做詳 細說明。 具有訊息還原功能之有效多重簽章機制 第一圖顯示一用以說明根據本發明的一具有訊息還原功 能之多重簽章機制之一表格。考慮一行動通訊應用，其中代表 存取（delegated accesse)能應用於無線網際網路，係藉由傳 送出一具有行動碼之訊息而完成。而利用多重簽章，所有代表 係能以平行方式去簽署該行動碼，因此，該接收端能鑑定該行 動碼之簽署者，且決定該行動碼之存取權限。 本發明提供一種以散離對數爲基礎且具有訊息還原功能 之新式有效多重簽章機制。該公開資訊（public information) 係由一質數/7、一*自然數〇t、一成員Ui之公開金鑰Yi、以及該 簽章所組成。且該秘密資訊包括該成員之私密金鑰义與隨機 數么。現給予本發明機制做安全分析。 令Θ爲一大質數、α爲質數p所產生之有限場GF(p)內 之一元素、以及一單向雜湊函數H。所有成員皆已知a α與H。 每一成員各自於0與之間亂數選取其私用金鑰义，使得 gccKX,，P-/) = 1，然後計算Y: s (a)Xi m〇de係爲其公開金鑰。 14 200418297 瘕設有位成員欲簽署一訊息M e Z/7,則可簡明扼要的假設 該位成員係爲Ui，U2, ·.·，υη·ι，以及Un。而不同於Harn所提 出之機制，本發明之機制並不需一指定登記員。該初始簽署者 U!係扮演首先簽署該訊息Μ之初始者，並且告知該其他成員 簽署該訊息M。IL也負責集合與驗證每一 IL之個別簽章（其 中2 Si </?)，並且產生一用於訊息Μ中之所有成員之組含 式多重簽章。本發明之機制係由下列階段所組成：個別簽章產… 生階段、多重簽章產生階段、以及多重簽章鑑定階段。 個別簽章產生階段 -基本個別簽章之產生： 當U!簽署該具有適當冗位之訊息Μ時，該仏使用其私密 金鑰心將Μ加密。假設m係爲Μ之密文。選取一介於1 與Θ-1之間之隨機數h，且計算 rl ^ [m · (a)-Jcl] mod p (1) si ^ [xi , (^/ . ri)] m〇d (p-1) (2) U!於訊息M中所簽署之基本簽章係由（n，s!，H(M))三部 份組成。簽署訊息M然後，仏會傳送（n，Sl，H(M))給所有其 他成員IL·，IL·，...，以及U,，且私下保存該數b。 -基本個別簽章之鑑定： 當其他成員U,(其中2 S i S 77)接收（n，Sl，H(M))時’ U,將試著還原該密文m，並且藉由使用⑴之公開金鑰去驗證 15 200418297 該基本個別簽章（n，sO之確實性。IL執行下列/方程式用以還 原m : Y1 · rl · (a)rl-sl = [(α)Χ1 · m · (α)-^Γ· (a)-Xl+^/] modp =m mod p ( 3 ) 爲了不致混淆，所以在此將還原之m標示爲m’ ， U, 使用U!之公開金鑰將m’解密爲本文Μ’ ( plaintexi Μ')， 並且檢驗Μ’是否滿足等式Η(Μ’）： H(M) mod ρ。藉由式 (3) ，IL也驗證了該基本個別簽章（n，s「）之確實性。 -個別簽章之產生 假如同意Μ之內容，則會依下列步驟去簽署m，並且 產生其個別簽章。 步驟1 :隨機選取一介於1與間之數么’且計算 ri = [m · (α)-^Ί mod ρ (4) 步驟2 ··解該等式 si = [Xi - {ki - ri)] mod (p-1) (5) IL於訊息M中之個別簽章係由（ri, sO兩部份組成。 IL產生了訊息M之個別簽章後，會傳回（h sd給該初 始者，並且私下保存該數么。 多重簽章產生階段 -個別簽章之驗證： 依據所接收之任一個別簽章（r:，Sl) ’其中2 $ 1 $ n ’ 16 200418297 ⑴將試著還原該密文m，並且藉使用U:之公開金鑰以驗證該 個別簽章（n，s〇之確實性。藉由式（6)之執行，U!可還原 該訊息m。Sl, (M)) to all other signatories. An i-th signer (of which 2 S i S /?) Uses Y1 · rl · (a) rl-sl to restore the ciphertext m, where the ciphertext m of f 6 is marked here as m '; and The authenticity of the signature (n, Sl) is verified by using the public key of the initial signer. Does the i-th signer (of which 2 Si ^ / 7) receive (n, s ^, H (M)) choose a random number between 1 and P-1, and calculates from (a) -i: / and The remainder ri (ξ [m · (c〇 士) παί / / 0 and the remainder si obtained by dividing [Xi-(h-ri)] by p-1 (ξ [Xi-(h ·-ri)]; return (n, Sl) to the initial signatory. According to any individual signature received (n, of which 2 S i 2 η, the initial signatory Use Yi · ri · (a) ri-si to restore the ciphertext m, and use the public key of the i-th signer to verify the authenticity of the individual signature (n, sO. The initial signer calculates R ( s [m · (a)-(ir / -rl)-…-(hr /?)] mod / 7) and S (ξ Ri. [si + s2 + ··. + s; 7] mod (/ Μ )), Combine a multi-signature (R, S, H (M)) for the message M with n signers; and send the multi-signature to an external verifier. The external verification is based on the received The combined multiple digital signature (R, S, H (M)) for message M verifies the authenticity of the multiple signature, and by using the public keys Y of all signers, (its ($ 1 S force) to restore the message m from multiple signatures. According to another object of the present invention, it provides a computer implementation of a 200418297 (t, η) threshold multiple signature mechanism with a message restoration function. Method / used to generate and verify digital signatures, where the system coefficient is a large prime A α and a one-way hash function Η, multiple signatures are used to generate a continuous digital signature for a message m Chapter, and randomly select its private key between 0 and 0 so that gCiKXi, less /) = 1, and then calculate 丨 Ξ (a) Xi mod as its public golden mirror, the method includes the following steps: a ·: The signatory selects a random polynomial with M term in the factory…, so that π—… —— 山. ~ / &Quot; mod (Ρ- /), where U is the privacy of the i-th signer Using a key; and in a secure channel will be transmitted to 仏 (where 1 2 j S η, and j # i) and broadcast ^ (~ > 111 (3 (1/7, one of multiple signatory initial The signer signs a message M with appropriate redundancy, and M is encrypted by the signer's private key Xi The ciphertext m; choose a random number h between 1 and; 7-1, and calculate a remainder rl (ξ [πι · (a)- i7] 727 ^ / 0, and calculate one. The remainder sl (4X1-U7 rl) + QiLl] / 77W obtained by dividing [Χία /-rl) + OlLl] by p-1. Transfer (n, si, H ( M)) to all other signatories; among them only 仏 knows each one, so -1 can only borrow L, Ξ (ΓΤ —— mod (pl)) is calculated by the UI (any of which is ancient 1), and because l値 has no secret information, so it is public. The i-th signer (of which 2 s 1 幺 / 0 uses Y1 · · rl · (c0rl-sl to restore the ciphertext m; 12 200418297 and verify the using the public key of the initial signer The authenticity of the signature (ri ,; where the reduced ciphertext m is marked as, and λχ ξ Y] L〇 ^ / j (Xl) mod (/ 7-l) j ^ t + l. The i-th signature (Where 2 Si Sr) receives (n, st, H (M)), chooses a random number between 1 and /;-1, and calculates the product of (a) f and message m divided by P And the remainder ri (5 /?) Of ， and calculate the remainder κ number si (4Xi-(β-η)-QiLi] 守-/ divided by [Xi-(β-ri)-QiLi] Pi- / Knife; and return (n, to Ω / Ξ the initial signatory, where ㈣ and L, ξ ΓΤ —mod (p -1) k-l9k ^ i-"k 〇 according to any individual signature received (Η, s,), where 2 S i < t, the initial signer uses Yi · λΐ · ri · (a) ri-si to restore the ciphertext m, and borrows the open money of the first signer Key to verify the authenticity of this λί = Y \ afjiXi) mod {pl) signature (n, Si); where > ί + 1. The initial signatory count R (= (m · (a)-U / -rl)-···-(private) mod; 7) and S (R-1 · [si + s2 +. · + Sr] mod QM)) , Combining a multi-signature (R, S, Η (M)) for the message M containing n signers; and sending the multi-signature to an external verifier. According to the received multi-signature for the message M Combined multiple digital signatures (R, S, H (M)), an external verifier verifies the authenticity of the multiple signatures, and by using the public keys of all signers (1 S i S 77) The message m is restored from multiple signatures. 13 200418297 In order to make the above and other purposes, features, and advantages of this creation more apparent, the following describes the preferred embodiment of this creation in conjunction with the accompanying drawings for detailed explanation. The following is a detailed description of the preferred embodiment of the present invention and detailed description with reference to the accompanying drawings. An effective multi-signature mechanism with a message restoration function The first figure shows a method for explaining A form of multiple signature mechanisms for message restoration. Consider a mobile communications application in which delegated accesse can be applied On the wireless Internet, this is done by sending a message with an action code. With multiple signatures, all delegates can sign the action code in a parallel manner, so the receiver can identify the action code. The signer and determines the access rights of the mobile code. The present invention provides a new and effective multi-signature mechanism based on scattered logarithms and with a message reduction function. The public information is composed of a prime number / 7, a * natural number 0t, a public key Yi of a member Ui, and the signature. And does the secret information include the member's private key meaning and random number? The mechanism of the present invention is now given for security analysis. Let Θ be a large prime number, α be an element in the finite field GF (p) generated by the prime number p, and a one-way hash function H. All members know a α and H. Each member randomly selects their private key meaning between 0 and 0, so that gccKX ,, P- /) = 1, and then calculates Y: s (a) Xi mode as its public key. 14 200418297 There is a member who wants to sign a message Me Z / 7, and it can be concisely assumed. The members are Ui, U2, ···, υη · ι, and Un. Unlike the mechanism proposed by Harn, the mechanism of the present invention does not require a designated registrar. The initial signer U! Acts as the original signer who first signs the message M and informs the other members to sign the message M. The IL is also responsible for assembling and validating the individual signatures (of which 2 Si < /?) Of each IL, and generating a set of multiple signatures for all members in the message M. The mechanism of the present invention is composed of the following stages: the individual signature production stage, the multiple signature generation stage, and the multiple signature identification stage. Individual signature generation phase-Basic individual signature generation: When U! Signs the message M with appropriate redundancy, the card uses its private key to encrypt M. Let m be the ciphertext of M. Select a random number h between 1 and Θ-1 and calculate rl ^ [m · (a) -Jcl] mod p (1) si ^ [xi, (^ /. Ri)] m〇d (p -1) (2) The basic signature signed by U! In message M is composed of (n, s !, H (M)). After signing the message M, 仏 will send (n, Sl, H (M)) to all other members IL ·, IL ·, ..., and U, and save the number b in private. -Identification of basic individual signatures: When other member U, (of which 2 S i S 77) receives (n, Sl, H (M)) 'U, will try to restore the ciphertext m, and by using ⑴ Public key to verify 15 200418297 the basic individual signature (n, sO's authenticity. IL executes the following / equation to restore m: Y1 · rl · (a) rl-sl = [(α) χ1 · m · (α)-^ Γ · (a) -Xl + ^ /] modp = m mod p (3) In order not to confuse, here we mark the restored m as m ', U, using the public key of U! to m 'Decrypt as the text M' (plaintexi M '), and check whether M' satisfies the equation Η (Μ '): H (M) mod ρ. With equation (3), IL also verified the basic individual signature ( The authenticity of n, s ").-If the generation of individual signatures agrees with the content of M, the following steps will be used to sign m, and its individual signature will be generated. Step 1: Randomly select a number between 1 and between 'And calculate ri = [m · (α)-^ Ί mod ρ (4) Step 2 · Solve the equation si = [Xi-(ki-ri)] mod (p-1) (5) IL in the message The individual signatures in M are composed of (ri, sO). The IL generates the individual signatures of the message M After that, it will return (h sd to the initiator, and save the number privately. Multi-signature generation stage-verification of individual signatures: according to any of the individual signatures received (r :, Sl) 'of which 2 $ 1 $ n '16 200418297 ⑴ will try to restore the ciphertext m, and use the public key of U: to verify the authenticity of the individual signature (n, s〇. With the implementation of formula (6), U! Can restore the message m.
Yi · ri · (a)ri-si ^ [(a)Xi · m · {a)-ki · (a)-Xi+^/] mod p ξ m’ mod p ( 6 ) 藉由式（6)還原該訊息m’然後，將該還原訊息 與傳送給之原始訊息做比較，並且核對兩訊息是否一致。 假如該兩訊息一致，該個別簽章（n，Sl)之確實性係被驗證。 當該個別簽章驗證通過時，也就是從該個別簽章還原 出之訊息與該原始訊息係爲一致時，然後IL係藉由執行式（7) 將（〇〇-七//27(^；7由1：1還原。 ri · m-1 ^ [m · {a)-ki · m-1] mod p = (a)-ir/ mod p (7) -組合式多重簽章之產生 一旦接收所有個別簽章，而且該個別簽章全部通過驗 證’接著所有（α)-β係被算出，然後仏可算出R與S，其定義 如 R ξ [rl · (a)-i:2 ·…·（α)-々77 · (a)/7 ·…·（a)//7] mod /7 (8) Ξ [m · {o)-kΙλ-xl -k2Jrx2-k3Jrx3-...-kn-vin ] mod p Ξ [m · (a)- (17-rl) - ·*·- {kn-xn) ] mod p S = R-l · [si + s2 +·..+ s/7] mod (/7-1) 然後，用於該訊息M之IL，U2, ...，以及U,之組合式多 17 (9) 200418297 重簽章係爲（R，S，H(M))。仏將該多重簽章傳送給外部驗證 者。 多重簽章驗證階段 依據所接收之訊息Μ之組合式多重數位簽章（R，S, Η(Μ))，一外部驗證者必須使用所有簽署者之公開金鑰Υ» (其 Φ 1 S i S /7)驗證該多重簽章之確實性，並且將訊1 m從 該多重簽章中還原。與所有簽署者有關聯之群體公開金鑰Y 係由式（10)決定。 Υ ξ Π Yi mod p, where l < i < η (10) 而還原及驗證之程序，其步驟如下： 步驟1 :計算 Y · R · (〇c)-SR (11) ξ [(α)(Χ1 + ... + Χ/7) · m · (α)-^：7+Γΐ-^+Γ2...-1/?+Γ/7 · (a)-Xl+l/-ri-X2+U-r2··· ~ Xn^kn-m] mod p ξ m’ mod p 步驟2:使用IL之公開金鑰將m’解密爲本文M’ ’且檢 驗式（11)所還原出之Μ’是否滿足等式H(M’）= H(M) mod /7。假如Μ’滿足該等式，則該組合式多重簽章之確實性係被 驗證。 具有訊息還原功能之門檻多重簽章機制 第三圖顯示一用以說明根據本發明的一具有訊息還原功 200418297 能£門檻多重簽章機制之表格。雖然多重簽章機制能分享一組 簽署者間之簽署訊息責任，但卻不能阻止一驗證者保證一成員 >系爲一多重簽章之一真正參與者。於一些應用中，最爲驗證者 所關切係爲一訊息被群體之法定最低人數所簽署。但必須讓該 驗證者不能驗證某人是否真正參與產生該群體之一簽章。於此 情況：便需要一（Λ /7)門檻多重簽章機制。 藉由改進第3節所說明之多重簽章機制以設計一具有訊… 息還原功能之門檻多重簽章機制。爲了簡化陳述，下列符號係 與第二圖所使用之符號相同。且將以數學證明方式以證實本發 明之機制能夠正確執行。 簡明扼要的假設這些出自於/7成員中之ί位簽署者係 爲Ui，u2,…，以及Ut。該初始簽署者lh係扮演初始者， 亦即首位簽署者，並且告知該其他參予者去簽署該訊息Μ。 仏也負責集合與驗證所有之個別簽章（其中2 < i ^ /7)， 並且產生一用於訊息Μ中之所有成員之組合式多重簽章。本 發明之機制係由下列階段所組成：私用金鑰分享階段、個別簽 章產生階段、多重簽章產生階段，以及多重簽章鑑定階段。 初步：私用金鑰分享階段 當系統開始運作，每一群體成員必須依據該（Λ /7)門檻 秘密分享機制扮演一分發者（dealer)以將各自秘密金鑰之投 影分配給其他群體成員。 假設Zl係爲與成員Ui有關聯之公開資訊，而且X:係爲U, 之私密金鑰。每一群體成員係於厶./中選取一含項之隨機 19 ^041^297 多項式义(义），使得— u、+ mod (W)，其中χ.係爲仏之私用金鑰。然後Ui於一安全通道中 一、 狩f Μ專送至1^(其中1 Sj Sn，且j # i)，並且播送 mod p。 假如一新成員U w欲參與該系統，則該成員首先須於 〇與P-/之間亂數選取其私用金鑰，使得gccKX/，，乃* 1。.h 然後所有成員必須依據（Λ /7+1)門檻秘密分享機制以重複上 述之秘密金鑰分享程序。 個別簽章產生階段 -基本個別簽章之產生 當首位簽署者仏欲簽署該具有適當冗位之訊息Μ，該 IL使用其私密金鑰μ加密。假設m係爲μ之密文。然 後仏選取一介於1與；7-1之間之隨機數h，並且計算η與Sl。 rl = [m · (α)-^/] mod p (21 ). si = [XI - (Jcl - rl) + Q1L1] mod (ρΊ) (22) Ω1 Ξ 一i) A Ξ ΓΙ ^ -mod(j7~l) 中 j=t^l ，且 ；t=U=l.An·厶i 一 之/fc ，而Ω1只能藉由Ih做計算，因爲只有仏知道每一個 乃匕），其中任何θ 1 〇且因爲L1之値無關任何秘密資訊，所 20 200418297 以L1値係爲公開。 ’ U!於訊息Μ中所簽署之基本簽章係由（n，Sl，部 份組成。而簽署訊息Μ然後，Ui傳送（n，Si，H(M)) 所有其 他成員U2, lh，…，以及U:，且私下保存該數h。 -基本個別簽章之鑑定： 當任一成員IL (其中2 S i S r)接收（n，H(M)) 時，U,將試著還原該密文m，並且藉由使用仏之公開金鑰以 驗證該基本個別簽章（n，Sl)之確實性。Ui首先執行下列方程 式用以還原m Y1 · XlLi · rl · (a)rl-sl (23) 三[(α)Χ1 · (α)Ω1Μ · m· (a)i/· (a)rl - XI + - rl - QlLl] mod p ξ m’ mod p Ξ niod(p-l) 其中 〇 然後U,使用IL之公開金鑰將m’解密爲本文M’ ’並且 檢驗M’是否由式（23) S原並滿足等式H(M ) = H(M) mod /7。藉由式（23)，IL也驗證了該基本個別簽章（n，sd之確實 性。 -個別簽章之產生 假如同意Μ之內容，則會依下列步驟去簽署m ’並且 產生其個別簽章。 200418297 步驟1 :隨機選取一介於1與ΐι間之數厶，且計算 ri ^ [m · mod p (24) / 步驟2 :解該等式 si Ξ [Xi . {ki - π) - ΩιΙι] mod (p^l) f 25) Ωί = ^fjiz^modip-l) Α· Ξ Π — mod(p~l) 其中 卢十1 ，且 k=l,k右i Zi 一乙k IL於訊息M中之個別簽章係由（n，Si)兩部份組成。Yi · ri · (a) ri-si ^ [(a) Xi · m · (a) -ki · (a) -Xi + ^ /] mod p ξ m 'mod p (6) is reduced by equation (6) The message m 'then compares the restored message with the original message sent to it, and checks whether the two messages are consistent. If the two messages are consistent, the authenticity of the individual signature (n, Sl) is verified. When the verification of the individual signature is passed, that is, when the information restored from the individual signature is consistent with the original message, then the IL will execute (〇〇- 七 // 27 (^ ; 7 is restored by 1: 1. Ri · m-1 ^ [m · {a) -ki · m-1] mod p = (a) -ir / mod p (7)- Receive all individual signatures, and all the individual signatures are verified. Then all (α) -β systems are calculated, and then R and S can be calculated, which are defined as R ξ [rl · (a) -i: 2 · … · (Α) -々77 · (a) / 7 · ... · (a) // 7] mod / 7 (8) Ξ [m · (o) -kΙλ-xl -k2Jrx2-k3Jrx3 -...- kn-vin] mod p Ξ [m · (a)-(17-rl)-· * ·-(kn-xn)] mod p S = Rl · [si + s2 + · .. + s / 7] mod (/ 7-1) Then, the combination of IL, U2, ..., and U, used for this message is 17 (9) 200418297. The resignature is (R, S, H (M)).传送 Pass the multiple signatures to an external verifier. The multi-signature verification phase is based on the combined multi-signature (R, S, Η (Μ)) of the received message M. An external verifier must use the public keys of all signers Υ »(its Φ 1 S i S / 7) verifies the authenticity of the multiple signatures, and restores 1 m from the multiple signatures. The group public key Y associated with all signers is determined by equation (10). Υ ξ Π Yi mod p, where l < i < η (10) The procedure for reduction and verification is as follows: Step 1: Calculate Y · R · (〇c) -SR (11) ξ [(α ) (Χ1 + ... + Χ / 7) · m · (α)-^: 7 + Γΐ-^ + Γ2 ...- 1 /? + Γ / 7 · (a) -Xl + l / -ri -X2 + U-r2 · ~~~ Xn ^ kn-m] mod p ξ m 'mod p Step 2: Use IL's public key to decrypt m' into this article M '' and restore it from the test formula (11) Whether M ′ satisfies the equation H (M ') = H (M) mod / 7. If M 'satisfies this equation, the authenticity of the combined multi-signature is verified. Threshold multiple signature mechanism with message restoration function The third figure shows a table for explaining a threshold multiple signature mechanism with message restoration function 200418297 according to the present invention. Although the multi-signature mechanism can share the responsibility of signing messages between a group of signers, it cannot prevent a verifier from guaranteeing that a member > is a true participant of a multi-signature. In some applications, the most validator's concern is that a message is signed by the legal minimum number of people in the group. But the validator must be prevented from verifying that someone is actually involved in generating one of the group's signatures. In this case: a (Λ / 7) threshold multiple signature mechanism is required. By improving the multi-signature mechanism described in Section 3, a threshold multi-signature mechanism with the function of information restoration is designed. For simplicity, the following symbols are the same as those used in the second figure. And mathematical proof will be used to prove that the mechanism of the present invention can be correctly implemented. It is concise to assume that these signatories from the / 7 members are Ui, u2, ..., and Ut. The initial signer lh acts as the initial signer, that is, the first signer, and informs the other participants to sign the message M.仏 is also responsible for assembling and verifying all individual signatures (where 2 < i ^ / 7), and generating a combined multiple signature for all members in message M. The mechanism of the present invention is composed of the following phases: a private key sharing phase, an individual signature generation phase, a multiple signature generation phase, and a multiple signature identification phase. Preliminary: Private key sharing phase When the system starts to operate, each group member must act as a dealer based on the (Λ / 7) threshold. The secret sharing mechanism distributes the projection of their secret key to other group members. Suppose Zl is the public information associated with member Ui, and X: is the private key of U ,. Each group member selects a random 19 ^ 041 ^ 297 polynomial meaning (meaning) in 厶 ./ such that — u, + mod (W), where χ. Is the private key of 仏. Then Ui is in a secure channel. First, f M is sent to 1 ^ (where 1 Sj Sn, and j # i), and mod p is broadcast. If a new member U w wants to participate in the system, the member must first randomly select his private key between 0 and P- /, so that gccKX /, is * 1. .h Then all members must repeat the secret key sharing procedure described above in accordance with the (Λ / 7 + 1) threshold secret sharing mechanism. Individual signature generation phase-Basic individual signature generation When the first signatory does not want to sign the message M with appropriate redundancy, the IL is encrypted using its private key μ. Let m be the ciphertext of μ. Then 仏 selects a random number h between 1 and 7-1, and calculates η and Sl. rl = [m · (α)-^ /] mod p (21). si = [XI-(Jcl-rl) + Q1L1] mod (ρΊ) (22) Ω1 Ξ i) A Ξ ΓΙ ^ -mod ( j7 ~ l) in j = t ^ l, and; t = U = l.An · 厶 i one of / fc, and Ω1 can only be calculated by Ih, because only 仏 knows that each is a dagger), any of them θ 1 〇 And because the 値 of L1 has nothing to do with any secret information, 20 200418297 uses L1 値 as the public. 'The basic signature signed by U! In message M is composed of (n, Sl, part. And after signing message M, Ui sends (n, Si, H (M)) all other members U2, lh, ... , And U :, and keep the number h privately.-Identification of basic individual signatures: When any member IL (of which 2 S i S r) receives (n, H (M)), U, will try to restore The ciphertext m, and the authenticity of the basic individual signature (n, Sl) is verified by using the public key of 仏. Ui first executes the following equation to restore m Y1 · XlLi · rl · (a) rl- sl (23) three [(α) × 1 · (α) Ω1M · m · (a) i / · (a) rl-XI +-rl-QlLl] mod p ξ m 'mod p Ξ niod (pl) where 〇 Then U, decrypts m 'into the text M' 'using the public key of IL and checks whether M' is derived from equation (23) S and satisfies the equation H (M) = H (M) mod / 7. (23), IL also verified the authenticity of the basic individual signature (n, sd.-If the individual signature is generated if it agrees with the content of M, it will follow the steps below to sign m 'and generate its individual signature. 200418297 Step 1: Randomly select a number between 1 and ΐι, Calculate ri ^ [m · mod p (24) / Step 2: Solve the equation si Ξ [Xi. (Ki-π)-ΩιΙι] mod (p ^ l) f 25) Ωί = ^ fjiz ^ modip-l) Α · Ξ Π — mod (p ~ l) where Lu Shi 1 and k = 1, k, right, Zi, B, and k IL. The individual signatures in the message M are composed of two parts (n, Si).
Ui產生了訊息Μ之個別簽章後，會傳回（n，Sl)給該初 始者lh，並且私下保存該數么。 多重簽章產生階段 -個別簽章之驗證： 依據所接收之任一個別簽章（n，s,)，其中2 S S r， 仏將試著還原該訊息m，且藉使用仏之公開金鑰去驗證該個 別簽章（n，Sl)之確實性。U!還原該訊息m係藉由下式完成：After Ui generates the individual signature of the message M, it will return (n, Sl) to the initiator lh, and save the number privately. Multi-signature generation phase-verification of individual signatures: According to any individual signature (n, s,) received, of which 2 SS r, 仏 will try to restore the message m and borrow the public key of 仏To verify the authenticity of the individual signature (n, Sl). U! Restore the message m is done by the following formula:
Yi · AiL, · ri · (a)n-si (26)YiAiL, · ri · (a) n-si (26)
e [(a)Xi · (a)QiLi · m · (c〇-h.· (a)ri - Xi + 々/ - ri - OiLi] 777<9c/ P =m* mod p 200418297 η Λ = PJ °^fj (χ，) m〇d( ρ -1) 其中 Μ+1 0 藉由式（26)還原該訊息m’然後，IL將m，與傳送給 U:之原始訊息做比較，並且核對兩訊息是否一致。假如該兩訊 息一致’該個別簽章（n，Sl)之確實性係被驗證。當該個別簽 章被驗證通過時，也就是從該個別簽章還原出之訊息與該原始 訊息係爲一致，Ui將由η還原，藉由執行 ri · m-1 ^ [m · (a)-Jci · m-1] mod p = {〇)-ki mod p (27) -組合式多重簽章之產生 一旦IL接收所有已通過驗證之個別簽章然後，Ih會計 算所有（a)-h、R、以及S，其定義如下： R ξ [rl · (a)-Jc2 * ... · (a)-iri · (a)rl · ... · (a)r/] mod p (28) ξ [m · (a)-17+rl-^+r2-i：j>+r3-...-I^+rr ] mod p ξ [m · (a)- (kl-rl) - *** - (kt-rt) ] mod p S ξ R-l · [si + s2 +...+ st] mod (p-1) (29) 然後，用於該訊息111之口1，112，...，11〃/以及11，之組合式多 重簽章係爲（R，s，H(M))。⑴將該多重簽章傳送給驗證者。 多重簽章驗證階段 於接收該用於訊息M之組合式多重數位簽章（R，S，) 23 200418297 然後，一外部驗證者必須使用所有簽署者之公開金鑰Yi (其 中1 S i S 77 ) ·以驗證該多重簽章之確實性，並且將訊息m 從該多重簽章中還原出來。與所有簽署者有關聯之群體公開金 鑰Y係由式（30)決定。 Y = ΠΥϊ mod /7, where l < i < η (30； 該還原及驗證之程序，其步驟如下： 步驟1 :計算 Y · R · (a)-SR (31) =[(a)(Xl + ... + Xt + Xt+l + ...+X77)-m· (a)-l/+rlU+r2U+r3-...-ir/+rt· (α)-Χ1+上/-Γ1-Χ2+β-Γ2.···.· — Xt+丄r-rt - Xt + 1-...-Χπ] mod;? Ξπι’ mod p 步驟2:將m’解密爲本文M’ ，且檢驗式（31)還原出 之：^1’是否滿足等式則：^’）=出：^)1110(1；7。假如：^’滿足該 等式，則該組合式多重簽章之確實性係被驗證。 具有訊息還原功能之有效多重簽章機制之安全分析 本發明之具有訊息還原功能之多重簽章機制可能遭受之 侵害（attack)，依據分析結果共可分爲三種類型。第一類型之 侵害係爲獲得該群體成員之私密金鑰。第二類型之侵害係爲僞 造該簽章（n，Sl)或任何多重簽章（R，S)。第三類型之侵害係 爲揭露該簽章中之訊息 200418297 以獲得私用金鑰爲目標之侵害 侵害1:欲意取得一簽署者之私用金鑰。 有三種可能方法用以取得任一群體成員之私密金鑰： 1. 從Yt立即還原出兄 因爲Υ, Ξ 所以從所對應之公開金鑰Yi中將 成員IL之私用金鑰X,還原，係等於解決該散離對數問題。 2. 藉由IL所產生之該組多重簽章中決定Xi。·· 藉由集合IL所產生之用於π不同訊息之多重簽章{(ru， s^)，（ n.2, Si.2)，…，（n.w，Sl,w)}，一入侵者或許能試著去解開形 式爲su ξ Xi -(上。-ru) mod (;?-1)之w方程式（其中1 S w)。因爲有w + 1項爲未知數（因爲每一多重簽章使用不同 之秘密iru)，所以該方程式之系統係未完全被決定，而且Ui 之私用金鑰係爲安全。 3. 還原任一秘密么_./，再藉由么j決定Xi 一入侵者可能欲直接從還原一些夂.>，或藉由解開上述 之該方程式Ξ Xi d - ru) mod (/7-1)之系統以決定L.y。 假如一入侵者可得到一些秘密數Lv，則藉由解開該方程式〜 - iv，》mod (/?-1)可決定。雖然每一個人可能能夠集 合一組IL所產生之多重簽章，但藉由解開該方程式之系統以 計算任一秘密數么〃係不可實行。因爲該未知數係比方程式之 數多出一個。另一方面，從（α)-々/，y· /77(9(^ /7還原該數么係等於 解決該散離對數問題。 侵害 2 :共謀（Conspiracy) 25 200418297 當一些成員之私用金鑛被揭露或一群合法成員共謀時，則 任一其他成員之私用金鑰將會被洩漏。假設一群合法成員（Uu， Ul,2，…，UL.t)共謀（其中2 < ί < /7-1)，或該群成員之私用 金鏡已被掲.露。於此狀況中’适些成貝之私用金綸XL,j與秘密 數(其中1 ^ j s t)係不再具安全性。假如該群共謀者 或入侵者欲取得其他成員之私用金鑰，則該群共謀者或入侵者 唯一能使用之方法係與侵害1中所述相同。因此，雖然成員之… 私密金鑰被洩漏或一群合法成員共謀，但其他成員之安全問題 仍然未被損害。 以僞造簽章爲目的之侵害 侵害3 : —僞造者可能僅以公開資訊，便欲僞造首位簽署 者仏所簽署之個別簽章（ri，Si)，其中1 S j S η，或僞造由 簽署者仏所簽署之任一已知訊息Μ之多重簽章（R，S)。 有三種方法可僞造個別簽章（n，Sl)或多重簽章（R，S): 假如一僞造者固定Μ與η，且欲計算一滿足Μ Γι · (a)n-si 之51値，則解Si値之計算等於解決該散離對數問 題。 假如一僞造者固定Μ與η，且欲計算一滿足5;三乂1-(L - n) 之$1値，然後解Sl之運算係等於去取得該私 用金鑰兄或於侵害1中所述之隨機秘密么.。 該侵害係稱爲取代侵害（substitution attack)，且如下分 析。 侵害4:僞造有一較強形式，其中知道一具有相對應簽章 26 200418297 的訊息Μ之一僞造者，可產生一些用於一特殊訊息形式Μ = m· (a)e 777M/7之有效簽章。雖然該Μ値之結果係無法受控制，· 但該僞造侵害之較強形式對於所有ElGamal機制及RSA係仍~ 具有危害；該侵害之典型預防係藉由一單向hash函數或一冗 位機制去完成。而下文中將提及該取代侵害係如何影響組合式 多重簽章之架構。 一僞造者可能會先於Zp中選擇任兩個整數A與B，並且•- 計算 R’ Ξ Μ · (α)-ΑΒ mod p e = A · (R， - B) 令Lets’ =A，然後該對（R’，S’ ）係爲該訊息M’ = M · (a)e mod /7之組合式多重簽章。當任一驗證者接收（R’， S’ ）時，可將Μ’從該多重簽章中還原，藉由執行 Υ · R’ ·（cc)-S’ R，三[Y · Μ · (〇c)-AB · (a)-AR， ] mod p ξ [M · (a)A(R，-B)] mod p ξ [M · (a)e] mod p ξ M’ mod p 藉此方式，一僞造者可冒充爲一初始者，並且使用類似之 運算以產生一用於某些不受控（uncontrolled)訊息之僞造有效 基本簽章。因此，縱使該個別簽章不能被僞造，該機制仍需要 一單向hash函數或適合之冗位機制去預防該種侵害。 揭露訊息之侵害 侵害5 :簽署訊息之揭露 27 200418297e [(a) Xi · (a) QiLi · m · (c〇-h. · (a) ri-Xi + 々 /-ri-OiLi] 777 < 9c / P = m * mod p 200418297 η Λ = PJ ° ^ fj (χ,) m〇d (ρ -1) where M + 1 0 restores the message m 'by formula (26). Then, IL compares m with the original message sent to U: and checks Are the two messages consistent? If the two messages are consistent, the authenticity of the individual signature (n, Sl) is verified. When the individual signature is verified, the message restored from the individual signature and the The original information is consistent, Ui will be restored by η, by executing ri · m-1 ^ [m · (a) -Jci · m-1] mod p = {〇) -ki mod p (27)-combined multiple Generation of signatures Once the IL receives all the individual signatures that have passed verification, Ih then calculates all (a) -h, R, and S, which are defined as follows: R ξ [rl · (a) -Jc2 * ... · (A) -iri · (a) rl · ... · (a) r /] mod p (28) ξ [m · (a) -17 + rl-^ + r2-i: j > + r3- ...- I ^ + rr] mod p ξ [m · (a)-(kl-rl)-***-(kt-rt)] mod p S ξ Rl · [si + s2 + ... + st] mod (p-1) (29) Then, for the message 111, 1,112, ... 11〃 / and 11, the combined multi-signature-based weight of (R, s, H (M)).传送 Pass the multiple signatures to the verifier. The multi-signature verification phase receives the combined multi-signature (R, S,) 23 200418297 for message M. An external verifier must then use the public keys Yi of all signers (1 S i S 77 ) · To verify the authenticity of the multiple signatures, and restore the message m from the multiple signatures. The group public key Y associated with all signers is determined by equation (30). Y = ΠΥϊ mod / 7, where l < i < η (30; The procedure for the reduction and verification is as follows: Step 1: Calculate Y · R · (a) -SR (31) = [(a) (Xl + ... + Xt + Xt + l + ... + X77) -m · (a) -l / + rlU + r2U + r3 -...- ir / + rt · (α) -χ1 + /-Γ1-Χ2+β-Γ2.···.· — Xt + 丄 r-rt-Xt + 1 -...- Χπ] mod ;? Ξπι 'mod p Step 2: Decrypt m' into the text M ' , And the test formula (31) is restored: ^ 1 'satisfies the equation: ^') = out: ^) 1110 (1; 7. If: ^ 'satisfies the equation, the combined signature is multi-signature The authenticity is verified. Security analysis of effective multi-signature mechanism with message restoration function The multi-signature mechanism with message restoration function of the present invention may be attacked, which can be divided into three types according to the analysis results The first type of infringement is to obtain the private key of the group member. The second type of infringement is to forge the signature (n, Sl) or any multiple signatures (R, S). The third type of infringement is To expose the message in the signature 200418297 Infringement targeted for obtaining private keys Infringement 1: Desire Get a signer ’s private key. There are three possible ways to obtain the private key of any group member: 1. Instantly restore the brother from Yt. Because Υ, Ξ, the member is removed from the corresponding public key Yi. The restoration of the private key X of the IL is equivalent to solving the problem of the discrete logarithm. 2. Xi is determined in the group of multiple signatures generated by the IL.... Of multiple signatures {(ru, s ^), (n.2, Si.2), ..., (nw, Sl, w)}, an intruder may be able to try to unlock the form su ξ Xi-( -Ru) mod (;?-1) w equation (where 1 S w). Because w + 1 terms are unknown (because each multi-signature uses a different secret iru), the system of this equation The system is not completely determined, and Ui ’s private key system is safe. 3. Restore any secrets _. /, And then decide by Xi that an intruder may want to restore some 直接. ≫ directly, or The system of solving the above equation Ξ Xi d-ru) mod (/ 7-1) is used to determine Ly. If an intruder can get some secret number Lv, then by solving the equation ~-iv, "mod (/?-1) can be determined. Although each person may be able to combine multiple signatures generated by a set of ILs, it is not feasible to calculate any secret number by solving the system of the equation. Because the unknown number is one more than the number of equations. On the other hand, restoring the number from (α) -々 /, y · / 77 (9 (^ / 7) is equivalent to solving the problem of scattered logarithm. Infringement 2: Conspiracy 25 200418297 When the private use of some members When the gold mine is revealed or a group of legal members conspired, the private keys of any other members will be leaked. Suppose a group of legal members (Uu, Ul, 2, ..., UL.t) conspired (of which 2 < ί < / 7-1), or the private gold mirrors of members of the group have been exposed. In this situation, 'Suitable Cheng Jin's private gold XL, j and secret number (where 1 ^ jst) are No longer secure. If the group's co-conspirators or intruders want to obtain the private keys of other members, the only method available to the group's co-conspirators or intruders is the same as described in Invasion 1. Therefore, although members The private key was leaked or conspired by a group of legitimate members, but the security issues of the other members were still not compromised. Infringements for the purpose of forging the seal 3: The forger may only want to forge the first signer by using only public information Individual signatures (ri, Si) signed by 其中, of which 1 S j S η, or forged by the signatory 仏Multiple signatures (R, S) of any known message M signed. There are three ways to forge individual signatures (n, Sl) or multiple signatures (R, S): If a counterfeiter fixes M and η, And if you want to calculate a 51 値 that satisfies M Γι · (a) n-si, then the calculation of solving Si 値 is equal to solving the problem of the logarithm of dispersion. If a counterfeiter fixes M and η, and want to calculate a satisfiable 5; 1- (L-n) $ 1 値, and then the solution of Sl is equal to obtaining the private key brother or the random secret described in the violation 1. The violation is called a substitution attack , And the following analysis. Infringement 4: Forgery has a strong form, and one of the forgers who knows a message M with the corresponding signature 26 200418297 can generate some special message form M = m · (a) e 777M / 7 effective signature. Although the result of the MZ is beyond control, the stronger form of the forged violation is still harmful to all ElGamal mechanisms and the RSA system; the typical prevention of this violation is through one-way A hash function or a redundant mechanism is used to complete it, and how the substitution infringement affects it will be mentioned later. The structure of combined multi-signature. A forger may choose any two integers A and B before Zp, and •-calculate R 'Ξ Μ · (α)-ΑB mod pe = A · (R,-B) Let Lets' = A, then the pair (R ', S') is the combined multi-signature of the message M '= M · (a) e mod / 7. When any validator receives (R', S '), M ′ can be restored from this multiple signature by executing Υ · R' · (cc) -S 'R, three [Y · Μ · (〇c) -AB · (a) -AR ,] Mod p ξ [M · (a) A (R, -B)] mod p ξ [M · (a) e] mod p ξ M 'mod p In this way, a counterfeiter can impersonate an initiator And uses a similar operation to generate a forged valid basic signature for certain uncontrolled messages. Therefore, even if the individual signature cannot be forged, the mechanism still needs a one-way hash function or a suitable redundancy mechanism to prevent such infringement. Violation of Disclosure Message Violation 5: Disclosure of Signed Message 27 200418297
本發明所提出之具有訊息還原功能之多重簽章機翻Γ並不 保證該簽署訊息之隱私性。例如：任一人只要可截取υ,之個 別簽章（n，Sl)或多重簽章（R，S)，就能藉由具有_公開資訊 A a，Yi，…，與γ.之式（6)或（11)步驟，將該原始訊息Μ 還原。 . 提出不具資料保護能力之機制，其理由係由於許多使用數 位簽章之應用允許該訊息內容之顯露。假如該簽署訊息之隱私… 性係爲重要，也僅需一額外加密程序用以加強本發明所提出之 機制。 該加密程序係爲直接，簡言之，傳送者U,係利用接收者 U』之公開金鑰Υρ將其個別簽章元素ri加密：The multi-signature machine with a message restoration function proposed by the present invention does not guarantee the privacy of the signed message. For example: as long as any person can intercept individual signatures (n, Sl) or multiple signatures (R, S) of υ, they can use _public information A a, Yi, ..., and γ. (6 ) Or (11), restore the original message M. The reason for proposing a mechanism without data protection is because many applications that use digital signatures allow the content of the message to be revealed. If the privacy of the signed message is important, only an additional encryption procedure is needed to strengthen the mechanism proposed by the present invention. The encryption process is straightforward. In short, the sender U uses the public key 元素 ρ of the receiver U to encrypt its individual signature element ri:
Ci ^ [(Yj) - ki^rii · ri] mod p 亦即該原始簽章（n，Si)係被（Ci，Si)所取代’當IL接 收該簽章時，該UH系依據下列步驟將^還原： 步驟1 :計算 [Yj · (a)-si] mod ρ ξ [(a)Xi · (a)-[Xi - {ki - ri)]] mod p Ξ (a)(i：/ - ri) mod p 步驟2 :計算 {a{ki - ri) )Xj mod p ^ (aXj) (i：/- ri) mod= (Yj)(ir/-ri) mod p 步驟3 :將n從Ci還原，係藉由執行 [{Y)){ki - π) · Ci]mod ρ = (Yi) * π) · (Yj)(-ir/+ri) · π mod ^ ξ ri mod pCi ^ [(Yj)-ki ^ rii · ri] mod p That is, the original signature (n, Si) was replaced by (Ci, Si) 'When the IL receives the signature, the UH is based on the following steps Restore ^: Step 1: Calculate [Yj · (a) -si] mod ρ ξ [(a) Xi · (a)-[Xi-{ki-ri)]] mod p Ξ (a) (i: / -ri) mod p Step 2: Calculate (a (ki-ri)) Xj mod p ^ (aXj) (i: /-ri) mod = (Yj) (ir / -ri) mod p Step 3: Change n from Ci reduction is performed by performing [{Y)) {ki-π) · Ci] mod ρ = (Yi) * π) · (Yj) (-ir / + ri) · π mod ^ ξ ri mod p
2S 200418297 如此，IL能得到該原始簽章（n，s〇，且依據3.1節以還原 該訊息Μ，並且認證該簽章。因爲僅U,具有私密金鑰兄，所 以一截取者並不能藉上述三個步驟將η解密。因此，該簽署訊 息Μ仍具保密性。 具有訊息還原功能之（Λ J)門檻多重簽章機制之安全分 析 很明顯地，本發明所提出之門檻多重機制可抵制與上述相 同之侵害，也就是該取得秘密資訊之侵害、僞造簽章之侵害、 以及揭露訊息之侵害皆可被預防。2S 200418297 In this way, the IL can obtain the original signature (n, s0, and restore the message M in accordance with Section 3.1, and authenticate the signature. Because only U has a private key brother, an interceptor cannot borrow The above three steps will decrypt n. Therefore, the signed message M is still confidential. Security analysis of the (Λ J) threshold multiple signature mechanism with message restoration function is obvious. The multiple threshold threshold mechanism proposed by the present invention can resist The same violations as above, that is, the violation of obtaining confidential information, the violation of forged signatures, and the disclosure of information can be prevented.
此外，藉由式（25)，當一侵襲者欲冒充一合法成員仏以 產生一個別簽章（n，Sl)時，必須先知道Ui之秘密金鑰與秘密 投影（secret shadows) ’(&)，其中 IS 但該侵害行爲具困難性，因爲從公開資訊欲得到係 等於去解決該散離對數問題。 比較 於此比較本發明機制與先前技術之功能和通訊成本。於 Harn之平行多重簽章機制中，假如需要/7位參與者簽署一訊 息，每一位參與者須計算一用於簽署之新値（fresh value) η， 而且傳送該新簽署訊息給所有其他參予者。於每一對簽署者之 間傳送該簽署訊息時’必須使用數量級訊息。因爲該用 於簽署一訊息之新値^必須傳送給所有其他簽署者，所以該簽 署者必須預先被決定。該需求也因此限制了該機制之使用。 29 200418297In addition, by formula (25), when an invader wants to impersonate a legitimate member to generate a unique signature (n, Sl), he must first know Ui's secret key and secret shadows' (&), Where IS, but the infringement is difficult, because the desire to obtain from public information is equivalent to solving the logarithm problem. Comparison The functions and communication costs of the mechanism of the present invention and the prior art are compared here. In Harn's parallel multi-signature mechanism, if / 7 participants are required to sign a message, each participant must calculate a fresh value η for signing and send the newly signed message to all other Participants. When sending the signing message between each pair of signers' must use an order of magnitude message. Because the new signature for signing a message must be transmitted to all other signers, the signatory must be determined in advance. This requirement also limits the use of this mechanism. 29 200418297
Harri之（Λ /?)門檻多重機制係相似於Hari之多重簽 章機制。 一Harri's (Λ /?) Threshold multiple mechanism is similar to Hari's multiple signature mechanism. One
該r位簽署者必須預先被決定，而且於義簽署者間之新 値交換所需要之訊息數量係於數量級訊息中。該需求限 制了 Ham之（Λ//)門檻多重機制於行動網路中之使用，其中 該行動網路之某些簽署者可能會由於行動節點或通訊連結失 敗而導致無法連線。於行動網路中，如果要請求一行動應用去 預先決定該f位簽署者，係有些不切實際。反而，該行動應 用必須動態地去決定該連上線之簽署者，用以選擇該〖位簽 署者。The r signatories must be determined in advance, and the number of messages required for a new exchange between righteous signers is in the order of magnitude. This requirement restricts the use of Ham's (Λ //) threshold multiple mechanisms in mobile networks, where some signers of the mobile network may fail to connect due to the failure of mobile nodes or communication links. In the mobile network, it is somewhat impractical to request a mobile application to determine the f signers in advance. Instead, the action application must dynamically determine the signer of the connection to choose the signer.
Langford提出兩種機制。第一種門檻機制需要一信任金鑰 (trusted key)產生中心以預先計算與儲存用於每一個別簽章 之分享部分。雖然單獨點（single pomt)失敗之風險能藉由採 用多重信任中心而會有所降低，但信任中心可能仍會成爲實施 之瓶頸或侵害點。此外，該機制假設係存在一用於該信任中心 之安全通道，用以使用一安全方式去分配秘密分享部分給簽署 者。於簽章產生階段時，建構該安全通道係需要額外安全協定 /結構之配合。該門檻（〖，/?)多重簽章機制會由於行動網路中 之頻繁的節點或連結之失敗’而有使用上之困難。於此情況 中，某些簽署者或該信任中心本身可能就無法連線。 於第二種機制中，信任中心被移除，但一組合者 (comMner)係仍需要集合與整合個別簽章。該機制也假設該 安全通道之存在’該通道係藉由額外安全協定或技巧’用以作 30 200418297 訊息之交換。於該機制中，一預先決定之分發群體係/需要協助 該分享部分之產生，而且於所有簽署者間，用以簽#所交換之 訊息數量係於數量級〇仏0中。爲實現r-OUt-〇f-/7之安全性，需 要〆位簽署者參與簽署過程。當起始點（author point)超 出界限時，該需求使第二種機制對於一大t而言變得不切實 際，因爲〆必須小於或等於/7値。 比較其他機制，本發明所提出之第一種多重簽章機制係叉… 援訊息還原能力，並且允許以動態方式決定簽署者。而除了簽 章產生階段需要數量級訊息外，並不需任何簽署訊息於 每一對簽署者間做交換。該機制也被延伸使用到支援行動網路 之群體簽章。 習知的多重簽章機制與門檻多重機制於不可靠之網路中 係不可實施如：行動網路，因爲於該機制中之所有簽署者必須 預先被決定，而且每一簽署者必須接收所有簽署者之簽署訊 息。於不可靠網路中，某些簽署者或許於一特定時間內無法連 線。而經比較後，本發明所提出之（t，η)門檻多重簽章機制 於行動網路中之表現係有效率，因爲該簽署者不需被預先決 定，而且通訊連結與主機失敗之原因係能夠被容許。而一法定 簽名人數之回覆係已足夠一門檻多重簽章之建構。 該比較結果係於表格1中作總結。最上面一列係列舉七種 不同種類之機制，其中包括了三種多重簽章機制與四種（Λ /7) 門檻多重簽章機制。該表格中之每一個輸入指示了有關於一估 算標準之一機制特性。表格中使用項目之定義如下： 31 η 參與者人數 t 連線簽署者之門檻人數 MS 姜重簽章機制 TMS 門檻多重簽章機制、 MR 訊息還原 TC 信任中心 其中所比較之先前技術分別爲： 200418297 [1] L. Harn, "Group-oriented (t, n) threshold digital signature scheme and digital multisignature," IEE Proc. of Computers and Digital Technique., Vol. 141, No. 5, pp. 307-313, Sep. 1994.Langford proposes two mechanisms. The first threshold mechanism requires a trusted key generation center to pre-calculate and store the shared part for each individual signature. Although the risk of single pomt failure can be reduced by using multiple trust centers, the trust center may still be a bottleneck or infringement point for implementation. In addition, the mechanism assumes that there is a secure channel for the trust center to use a secure method to distribute the secret sharing portion to the signatory. During the signature generation phase, the construction of the secure channel requires the cooperation of additional security protocols / structures. The threshold (〖, /?) Multi-signature mechanism will be difficult to use due to the frequent failure of nodes or links in the mobile network '. In this case, some signers or the trust center itself may not be able to connect. In the second mechanism, the trust center is removed, but a combination (comMner) still needs to gather and integrate individual signatures. The mechanism also assumes the existence of the secure channel, which is used for the exchange of 30 200418297 messages through additional security protocols or techniques. In this mechanism, a pre-determined distribution group system / needs to assist in the generation of the sharing part, and among all signers, the number of messages exchanged for signing # is in the order of magnitude 仏 0. In order to achieve the security of r-OUt-〇f- / 7, a signer is required to participate in the signing process. This requirement makes the second mechanism impractical for a large t when the author point is out of bounds, since 〆 must be less than or equal to / 7 値. Compared with other mechanisms, the first multi-signature mechanism proposed by the present invention is to support the ability to restore information and allow the signatories to be determined in a dynamic manner. In addition to the orders of magnitude required for signature generation, there is no need for any signing messages to be exchanged between each pair of signers. The mechanism has also been extended to groups that support mobile networks. The conventional multi-signature mechanism and threshold multi-mechanism cannot be implemented in unreliable networks such as: mobile network, because all signers in the mechanism must be determined in advance, and each signatory must receive all signature Signing message. On unreliable networks, some signers may not be able to connect for a certain period of time. After comparison, the performance of the (t, η) threshold multi-signature mechanism in the mobile network proposed by the present invention is efficient, because the signer does not need to be determined in advance, and the reason why the communication link and the host fail Can be allowed. The reply of a statutory number of signatures is enough to construct a threshold for multiple signatures. The comparison results are summarized in Table 1. The top series includes seven different types of mechanisms, including three multi-signature mechanisms and four (Λ / 7) threshold multi-signature mechanisms. Each entry in the table indicates the characteristics of a mechanism related to an estimate. The definitions of the items used in the table are as follows: 31 η Number of participants t Threshold number of connected signers MS Jiang re-signature mechanism TMS threshold multi-signature mechanism, MR message restoration TC Trust Center The previous technologies compared among them are: 200418297 [1] L. Harn, " Group-oriented (t, n) threshold digital signature scheme and digital multisignature, " IEE Proc. Of Computers and Digital Technique., Vol. 141, No. 5, pp. 307-313 , Sep. 1994.
[2] L. Harn, "New digital signature scheme based on discrete logarithm,M Electronics Letters, Vol. 30, No. 5, pp. 396-298, Mar. 1994.[2] L. Harn, " New digital signature scheme based on discrete logarithm, M Electronics Letters, Vol. 30, No. 5, pp. 396-298, Mar. 1994.
[3] S. K. Langford, “Threshold DSS Signatures without a Trusted Party,” Advances in Cryptology - Crypto’ 95 proceedings, Springer-Verlag, pp. 397-409, 1995. 現請參考第四圖，其中顯示用以說明不同多重簽章機制之 表格。如該表格所顯示，本發明機制提供了訊息還原能力。且 該機制傳送之簽章大小係不會因簽署者人數增加而變大。因爲 簽署訊息不必於參與者之間做交換，所以本發明機制之總通訊 成本係比其他機制更低。本發明之（Λ 門檻多重簽章機制 係最適用於行動網路應用之群體授權機制。 雖然本發明已經於其相關較佳實施例做說明，然其並 32 200418297 非用以限定本發明，應了解任何熟習此技藝者<在不脫離許本 發明之精神與範圍內，當可作各種之修改與更ir，而不脫離本 發明於此所申請專利範圍之精神與範圍。而^本發明之保護範圍 當視後附之申請專利範圍所界定者爲準。 、， 第一圖顯示一用以說明先前技術之數位簽章機制之表格。•- 第二圖顯示用以說明根據本發明的一具有訊息還原功能 之多重數位簽章機制之表格。 第三圖顯示用以說明根據本發明的一具有訊息還原功能 之門檻多重簽章機制之表格。 第四圖顯示用以說明比較不同多重簽章機制之表格。[3] SK Langford, “Threshold DSS Signatures without a Trusted Party,” Advances in Cryptology-Crypto '95 proceedings, Springer-Verlag, pp. 397-409, 1995. Please refer to the fourth figure, which shows the difference Forms for multiple signature mechanisms. As shown in the table, the mechanism of the present invention provides message restoration capabilities. And the size of the signature transmitted by the mechanism will not increase with the increase in the number of signatories. Because the signing message does not have to be exchanged between participants, the total communication cost of the mechanism of the present invention is lower than other mechanisms. The (Λ threshold multi-signature mechanism of the present invention is a group authorization mechanism that is most suitable for mobile network applications. Although the present invention has been described in its related preferred embodiments, its combination 32 200418297 is not intended to limit the present invention, it should be It is understood that any person skilled in the art can make various modifications and changes without departing from the spirit and scope of the present invention, without departing from the spirit and scope of the patent scope of the present invention. ^ The present invention The scope of protection shall be determined by the scope of the attached patent application. The first figure shows a form for explaining the digital signature mechanism of the prior art. • The second figure shows the form for explaining the A form for a multiple digital signature mechanism with a message restoration function. The third figure shows a table for explaining a threshold multiple signature mechanism with a message restoration function according to the present invention. The fourth figure shows a table for explaining the comparison of different multiple signatures. Chapter mechanism table.
Claims (1)
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| TW92105426A TWI248744B (en) | 2003-03-13 | 2003-03-13 | Multisignature scheme with message recovery for group authorization in mobile networks |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| TW92105426A TWI248744B (en) | 2003-03-13 | 2003-03-13 | Multisignature scheme with message recovery for group authorization in mobile networks |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| TW200418297A true TW200418297A (en) | 2004-09-16 |
| TWI248744B TWI248744B (en) | 2006-02-01 |
Family
ID=37429193
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| TW92105426A TWI248744B (en) | 2003-03-13 | 2003-03-13 | Multisignature scheme with message recovery for group authorization in mobile networks |
Country Status (1)
| Country | Link |
|---|---|
| TW (1) | TWI248744B (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US8238551B2 (en) | 2005-01-27 | 2012-08-07 | Interdigital Technology Corporation | Generation of perfectly secret keys in wireless communication networks |
| US8280046B2 (en) | 2005-09-12 | 2012-10-02 | Interdigital Technology Corporation | Method and system for deriving an encryption key using joint randomness not shared by others |
| TWI797147B (en) * | 2017-08-15 | 2023-04-01 | 安地卡及巴布達商區塊鏈控股有限公司 | Threshold digital signature method and system |
-
2003
- 2003-03-13 TW TW92105426A patent/TWI248744B/en not_active IP Right Cessation
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US8238551B2 (en) | 2005-01-27 | 2012-08-07 | Interdigital Technology Corporation | Generation of perfectly secret keys in wireless communication networks |
| US8280046B2 (en) | 2005-09-12 | 2012-10-02 | Interdigital Technology Corporation | Method and system for deriving an encryption key using joint randomness not shared by others |
| TWI797147B (en) * | 2017-08-15 | 2023-04-01 | 安地卡及巴布達商區塊鏈控股有限公司 | Threshold digital signature method and system |
Also Published As
| Publication number | Publication date |
|---|---|
| TWI248744B (en) | 2006-02-01 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| KR0146437B1 (en) | Identification scheme, digital signature giving message recovery scheme, digital signature with appendix schemie, key exchange scheme,.. | |
| US9160530B2 (en) | Method and apparatus for verifiable generation of public keys | |
| CN1777096B (en) | Password protection method and device | |
| US6535980B1 (en) | Keyless encryption of messages using challenge response | |
| JP2008507892A (en) | System and method for implementing a digital signature using a one-time private key | |
| JP2002534701A (en) | Auto-recoverable, auto-encryptable cryptosystem using escrowed signature-only keys | |
| JP2005520364A (en) | System and method for updating and extending a digitally signed certificate | |
| Tsai et al. | An ECC‐based blind signcryption scheme for multiple digital documents | |
| Liu et al. | Extension of elliptic curve qu–vanstone certificates and their applications | |
| TW200418297A (en) | Multisignature scheme with message recovery for group authorization in mobile networks | |
| JP5099771B2 (en) | Two-factor authentication system | |
| JP2513169B2 (en) | User authentication method | |
| KR100349418B1 (en) | Method for preventing abuse in blind signatures | |
| Yu et al. | Cryptanalysis of an off-line electronic cash scheme based on proxy blind signature | |
| Brickell et al. | ENHANCED PRIVACY ID: A REMOTE ANONYMOUS ATTESTATION SCHEME FOR HARDWARE DEVICES. | |
| Desmedt et al. | Identity-based key infrastructures (iki) | |
| Piper | An Introduction to Cryptography | |
| Al-Saidi et al. | E-Voting Authentication Preparation Scheme (EV-APS) Based on Evox-MA and REVS E-Voting Blind Signature Protocols | |
| Tanwar et al. | Applications of Digital Signatures in Cryptography | |
| Martinelli et al. | Automated analysis of some security mechanisms of SCEP | |
| Rizal Nurjaman et al. | Strengthening the Security of Deniable Authentication Scheme Using Zero-Knowledge Proof | |
| Foster | Study and Implementation of Algorithms for Digital Signatures in Network Security | |
| Zhang | Analysis of the Fair Quantum Blind Signature | |
| Melin et al. | Namecoin as authentication for public-key cryptography | |
| Merkle | 4. Protocols for |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| MM4A | Annulment or lapse of patent due to non-payment of fees |